Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 1039735" data-attributes="member: 86910">Yes, it is a security risk. Sadly, many legitimate installers abuse this to add tracking info, settings or other things into certificate structures, so they do not have to sign every single file.We had a case here in this thread: <a href="https://malwaretips.com/threads/glasswires-sha-256-hash-doesnt-match-the-one-listed-on-their-website.122381/" target="_blank">Need Advice - Glasswire&#039;s SHA-256 hash doesn&#039;t match the one listed on their website</a>Some software vendors put download URLs into the certificate structure. That is the worst case because malware authors can change this download URL into a malicious one and the file will still be valid and happily download malware.Validly signed executables are often excluded from antivirus detection signatures if they are assumed to be from a trusted source. E.g. if the publisher is Microsoft, it is seen as a trusted source.Another abuse case happened in the 3CX SmoothOperator supply chain attack. That one uses the tool from github and embedds encrypted malware code into the legitimate file. The file here works as a carrier for the malware, similar to a smuggler. It needs a second component to decrypt and execute the data. But it has the advantage that the actual malicious code is never on disk and the decryption code itself is small and not that suspicious.Explained in detail in this video:[MEDIA=youtube]jCXIKHCpvn8[/MEDIA]A good technical blog post about this topic is here: <a href="https://web.archive.org/web/20150426192725/http://blogs.msdn.com/b/ieinternals/archive/2014/09/04/personalizing-installers-using-unauthenticated-data-inside-authenticode-signed-binaries.aspx" target="_blank">Caveats for Authenticode Code Signing - IEInternals - Site Home - MSDN Blogs</a></blockquote>

[QUOTE="struppigel, post: 1039735, member: 86910"] Yes, it is a security risk. Sadly, many legitimate installers abuse this to add tracking info, settings or other things into certificate structures, so they do not have to sign every single file. We had a case here in this thread: [URL='https://malwaretips.com/threads/glasswires-sha-256-hash-doesnt-match-the-one-listed-on-their-website.122381/']Need Advice - Glasswire's SHA-256 hash doesn't match the one listed on their website[/URL] Some software vendors put download URLs into the certificate structure. That is the worst case because malware authors can change this download URL into a malicious one and the file will still be valid and happily download malware. Validly signed executables are often excluded from antivirus detection signatures if they are assumed to be from a trusted source. E.g. if the publisher is Microsoft, it is seen as a trusted source. Another abuse case happened in the 3CX SmoothOperator supply chain attack. That one uses the tool from github and embedds encrypted malware code into the legitimate file. The file here works as a carrier for the malware, similar to a smuggler. It needs a second component to decrypt and execute the data. But it has the advantage that the actual malicious code is never on disk and the decryption code itself is small and not that suspicious. Explained in detail in this video: [MEDIA=youtube]jCXIKHCpvn8[/MEDIA] A good technical blog post about this topic is here: [URL='https://web.archive.org/web/20150426192725/http://blogs.msdn.com/b/ieinternals/archive/2014/09/04/personalizing-installers-using-unauthenticated-data-inside-authenticode-signed-binaries.aspx']Caveats for Authenticode Code Signing - IEInternals - Site Home - MSDN Blogs[/URL] [/QUOTE]

Verification